Windows Procdump Process Execution

Alerts on execution of Sysinternals Procdump (32/64 variants) based on process creation image path.

FreeUnreviewedSigmamediumv1

windows-procdump-process-execution-2e65275c

title: Windows Procdump Process Execution
id: f244f4ee-d32d-4994-8dc9-00791266324d
status: test
description: This rule flags process creation events where the executable path ends with procdump variants (procdump.exe, procdump64.exe, procdump64a.exe). Procdump is commonly used to capture process memory, which can be used to extract sensitive data and credentials from running processes. The detection relies on Windows process creation telemetry, specifically the process image name in each event.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_procdump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-08-16
modified: 2026-06-29
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1003.001
  - attack.credential-access
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \procdump.exe
      - \procdump64.exe
      - \procdump64a.exe
  condition: selection
falsepositives:
  - Legitimate use of procdump by a developer or administrator
level: medium
license: DRL-1.1
related:
  - id: 2e65275c-8288-4ab4-aeb7-6274f58b6b20
    type: derived

What it detects

This rule flags process creation events where the executable path ends with procdump variants (procdump.exe, procdump64.exe, procdump64a.exe). Procdump is commonly used to capture process memory, which can be used to extract sensitive data and credentials from running processes. The detection relies on Windows process creation telemetry, specifically the process image name in each event.

Known false positives

Legitimate use of procdump by a developer or administrator

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.